CVE-2026-33051: 
PHP vulnerability analysis and mitigation

CVE-2026-33051 is a stored cross-site scripting (XSS) vulnerability in Craft CMS affecting the revision/draft context menu in the element editor. The vulnerability exists in versions 5.9.0-beta.1 through 5.9.10 of the craftcms/cms Composer package. It was published on March 16, 2026, added to the GitHub Advisory Database on March 18, 2026, and assigned a CVE by NVD on March 20, 2026. It carries a CVSS v3.1 base score of 5.4 (Medium) and a CVSS v4.0 base score of 5.3 (Medium) (GitHub Advisory, Craft CMS Advisory).

The root cause is improper neutralization of user-supplied input during web page generation (CWE-79). Specifically, the _contextMenuItems() method in src/controllers/ElementsController.php passes the creator's name (derived from fullName) directly into Template::raw() combined with Craft::t() string interpolation without HTML encoding, causing the value to be rendered as raw HTML in the revision/draft context menu. The fix, applied in commit f634a9d, wraps the $creator->name value with Html::encode() before interpolation. An attacker with low-privileged control panel access (e.g., Author role) can set their fullName to a JavaScript payload via the profile editor, then create an entry with two saves to persist the payload (GitHub Advisory, Patch Commit).

If an administrator views the revision/draft context menu for an entry created by the attacker while an elevated session is active, the injected XSS payload executes in the administrator's browser context. This can allow the attacker to escalate their own account to administrator privileges, resulting in full control panel takeover, unauthorized data access, and potential modification of site content or configuration. The vulnerability has low direct confidentiality and integrity impact on the vulnerable system itself, but significant downstream impact on the subsequent system (the administrator's session and the broader CMS environment) (GitHub Advisory, Craft CMS Advisory).

1. Obtain low-privileged access: Log in to the Craft CMS control panel with an Author-level or similarly low-privileged account.
2. Inject XSS payload into fullName: Navigate to the user profile editor and set the fullName field to a JavaScript payload, e.g., <script>fetch('/actions/users/save-user',{method:'POST',body:new URLSearchParams({userId:'ATTACKER_ID',groups:['1']}),headers:{'X-CSRF-Token':document.querySelector('[name=CRAFT_CSRF_TOKEN]').value}})</script> or a payload designed to elevate the attacker's account to administrator.
3. Create and save an entry twice: Create a new entry in the CMS and save it at least twice to generate revision history entries attributed to the attacker's account, embedding the payload in the revision context menu data.
4. Wait for administrator interaction: The payload executes when an administrator with an active elevated session opens the revision/draft context menu for the affected entry in the element editor.
5. Achieve privilege escalation: The XSS payload executes in the administrator's browser, performing actions such as elevating the attacker's account to administrator via authenticated API calls (GitHub Advisory, Craft CMS Advisory).

• Logs: Craft CMS access logs showing requests to /actions/users/save-user or similar privilege-modifying endpoints originating from an administrator session shortly after the administrator viewed an entry's revision context menu.
• User Profiles: Control panel user accounts with fullName fields containing HTML tags, JavaScript, or encoded script content (e.g., <script>, <script>, javascript:).
• Logs: Unexpected changes to user group membership or permissions in Craft CMS audit logs, particularly an Author-level user being elevated to Administrator.
• Network: Unusual outbound requests from the administrator's browser session to external domains or internal endpoints immediately after interacting with the element editor's revision/draft context menu.

Craft CMS has released version 5.9.11, which resolves this vulnerability by applying Html::encode() to the creator's name before rendering it in the revision context menu (Craft CMS Release, Patch Commit). All users running versions 5.9.0-beta.1 through 5.9.10 should upgrade immediately. As interim mitigations, restrict control panel access to trusted users only, review existing user fullName fields for suspicious HTML/script content, implement Content Security Policy (CSP) headers to limit script execution, and monitor administrator accounts for unexpected privilege changes.

The vulnerability was reported by security researcher "Neosprings" and published by "angrybrad" to the Craft CMS repository on March 16, 2026 (Craft CMS Advisory). The issue was classified as low-severity by Craft CMS in their changelog, bundled with fixes for other more critical vulnerabilities in the 5.9.11 release. No significant broader media coverage or notable community debate has been identified beyond standard vulnerability aggregator coverage.